EUVD-2026-90518
GHSA-xxhg-m845-4m9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Payments for Hubtel
-
DeliveryRequest public payment-callback with arbitrary order reference
-
ExploitEndpoint skips authorization check
-
ExecutionObtain order key and order contents
-
ImpactEnumerate further orders to harvest data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the Payments for Hubtel WordPress plugin prior to 1.0.2, requiring only that the site has the plugin installed and its public payment-callback endpoint reachable. The practical limiter is scope of impact rather than access: the attacker gains only read access to an order's key and contents (C:L), must reference/guess valid order identifiers to target specific orders, and cannot modify data or escalate privileges through this flaw alone. |
| Impact | This is a genuine but modest-severity information-disclosure flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent with the description: an unauthenticated, network-reachable, low-complexity IDOR (CWE-639) in a public payment-callback endpoint that leaks an arbitrary order's key and contents, with only low confidentiality impact and no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is bounded: the impact is confined to disclosure of order data (customer/order details tied to the exploited order key), not account takeover, code execution, or payment manipulation. This should be treated as a routine-priority patch rather than an emergency - the low prevalence of the plugin and C:L-only impact keep aggregate risk low, though unauthenticated reachability means any exposed install is trivially probeable. Note the companion flaw CVE-2026-96200 in the same plugin/version covers callback origin-spoofing (integrity); defenders patching one should patch both via v1.0.2. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's public Hubtel payment-callback URL referencing an order they do not own; because the endpoint never checks that the requester is authorized to view that order, the attacker obtains the target order's order key and is redirected to view its contents. Iterating over order identifiers lets them harvest other customers' order data. No POC is published in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated information disclosure in the Payments for Hubtel WordPress plugin (all versions before 1.0.2) allows remote attackers to retrieve the order key of an arbitrary order through the plugin's public payment-callback request and then view that order's contents. The flaw is an authorization bypass through user-controlled key (CWE-639): the callback handler redirects the requester without verifying they are permitted to view the order, so an attacker needs only to reach the callback endpoint and reference or guess a valid order identifier. It is a genuine but modest-severity issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the practical limit is that it grants read-only exposure of one order at a time and does not permit modification, privilege escalation, or service disruption.
RemediationAI
Apply the vendor-released fix: upgrade the Payments for Hubtel WordPress plugin to version 1.0.2 or later, which adds the missing authorization check on the public payment-callback request before redirecting the caller to an order view. Because the update is a plugin-only change, it can be rolled out without touching WordPress core, but verify immediately after upgrading that the callback endpoint still completes legitimate Hubtel payment notifications so that orders are not left in a pending state. If patching must be deferred, compensating controls are limited because the callback endpoint has to remain publicly reachable for Hubtel to confirm payments: you can restrict POST/GET access to the plugin's callback path using a web application firewall rule or server-level allowlist scoped to Hubtel's published notification source IPs, accepting the trade-off that any change to Hubtel's infrastructure or a missed IP range will silently break payment confirmation; alternatively, temporarily disable the plugin (and thus Hubtel payments) if order confidentiality outweighs lost checkout functionality. Also treat order keys as compromised where exposure is suspected, and ensure order keys are generated with sufficient entropy so that enumeration of valid identifiers is impractical, since the flaw lets a caller redeem any valid key it can reference or guess. Track the WPScan advisory at https://wpscan.com/vulnerability/fcaa1526-0cf4-4356-9cf8-bc2dc3ed33b8/ and the VulDB record at https://vuldb.com/vuln/412512 for any updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Payments for Hubtel is a WordPress e-commerce plugin that integrates the Hubtel payment platform, and like most WordPress payment gateways it exposes a public callback/webhook endpoint that Hubtel calls after a transaction so the site can finalize the order. The vulnerability is a classic CWE-639 authorization bypass through user-controlled key: the callback logic derives or accepts an order identifier (the order key) from the request and, rather than checking that the current requester is authorized to view that order, redirects the caller to an order-viewing context and leaks the order key and its contents. Because the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N, exploitation is confirmed as remote and unauthenticated with no user interaction, requiring only that the plugin be installed and the payment-callback endpoint reachable on the target WordPress site. The exposed credential is the order key itself, a WooCommerce-style identifier that functions as a capability to view order data, so leaking it converts into a persistent read primitive against that specific order. Impact is bounded to confidentiality of order contents (C:L), since the handler performs no data modification (I:N) and provides no denial-of-service path (A:N).
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Public unauthenticated network endpoint with no interaction (PR:N/UI:N/AC:L) leaking only order data gives C:L with no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB